[HOW TO] Change BSoD Error Messages

[invalidbuffalo]

DISCLAMER If your computer crashes or you lose data, it's not my fault. Always backup and create a restore point on your computer before attempting to modify any system file. If you don't feel comfortable modifying the windows kernel, stop reading. Otherwise, let's continue...

Ever wanted to change the messages displayed by BSoD's to something more interesting (e.g. instead of "A problem was detected on your computer and windows has been shut down..." it says "Windows suddenly decided to hate you. Deal with it.")? If so you've wandered to the right place. If not this is something to do on a very rainy day.

What you need:

Windows XP SP2 (may work with pre-sp2 but I havnt tried)

Resource Hacker

Heres what you do:

1) Locate ntoskrnl.exe in WINDOWS\System32\ and copy it to a location of your choice (desktop works fine)

2) Open the copy in resource hacker

3) Browse to the Message Table script

4) Edit the messages while keeping the following in mind:

-The message length cannot exceed the width of the screen. If you have a long message, break it into lines using \n where you want a new line to begin. For example notice how microsoft breaks the following string near the bottom at 1073741953:

"If this is the first time you've seen this Stop error screen,\nrestart your computer. If this screen appears again, follow\nthese steps:\n"

-keep your custom string "format" consistent with the original you're replacing (e.g. IRQL_NOT_LESS_OR_EQUAL to GATES_OWND_J00, not Gates ownd j00)

5) When you're done editing compile the script and save the file under a different name (must be 8 characters long) other than "ntoskrnl.exe" (e.g. bsodedit.exe)

there seems to be an issue with resource hacker locking up when compiling the script. please be patient as I investigate this.

6) Copy the renamed file into the system32 folder

7) Edit boot.ini by adding a copy of the windows xp boot path to the list and ending the line with /kernel=<renamed file>

For example my boot.ini is shown below

[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Winxp pro (no edit)" /fastdetect 
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Winxp pro (BSoD mod)" /fastdetect /kernel=bsodedit.exe

This way if something goes wrong you can boot the unmodified kernel. Save boot.ini when finished

8) Reboot

To test this you can manually generate a crashdump by adding the DWORD "CrashOnCtrlScroll" with a value of "1" to the key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\i8042prt\Parameters. After you reboot you can manually crash your computer by holding down right-ctrl and tapping scroll lock twice.

Once you're convinced your modded kernel is stable you may remove the original boot entry that points to ntoskrnl from boot.ini.

Special notes:

I have encountered no problems using this with bootskin.

Enjoy your customized BSoD messages . . . now just wait for your computer to crash.

Please post if you have feedback, questions, problems, etc

Edited June 25, 2006 by invalidbuffalo

[pmh]

haha, that's awesome! I'll have to try that out sometime.

[invalidbuffalo]

Let me know how it goes :cool:

[gadean]

I don't think I am brave enough to modify the kernel. But then again, I can always use Windows Recovery Console to edit the boot.ini if this fails to work.

Great post. I will add this to my long list of "cool things to do" and save it for a rainy day.

[DigitalE]

Interesting. Strangely enough, I've never even seen the BSOD on my laptop yet. My other computer does it somethimes, though :p

[invalidbuffalo]

  edwinmcdunlap said:

Interesting. Strangely enough, I've never even seen the BSOD on my laptop yet. My other computer does it somethimes, though :p

The only BSoD ive ever gotten was IRQL_NOT_LESS_OR_EQUAL and, of course, the user generated crashdump

[Cyranthus]

  invalidbuffalo said:

The only BSoD ive ever gotten was IRQL_NOT_LESS_OR_EQUAL and, of course, the user generated crashdump

ive had that before too... do you know what it means?

[invalidbuffalo]

I have no idea.

[dreamz Veteran]

  Cyranthus said:

ive had that before too... do you know what it means?

it could be an irq conflict.

nice guide.

[invalidbuffalo]

ive noticed that IRQL_NOT_LESS_OR_EQUAL seems to come up with hardware instability, like when i was pushing my ram timings on my pc I would get that a lot.